AMENDMENTS TO THE CLAIMS 

Please amend the claims as indicated hereinafter. 



1 . (Currently Amended): A method for capturing illegal and undesired behavior for 
network components and for interactions between components comprising: 

specifying one or more states and state transitions for one or more components or 
interactions between two or more components, wherein specifying includes specifying at 
least one composite state transition; and 

when a particular component or interaction between a particular two or more 
components enters a particular state or state transition if a said state or state transition occuri 
generating a notification corresponding to the particular specified state or state transition 
wherein the particular state or state transition is one of the one or more states or state 
transitions . 

2. (Currently Amended): The method recited in claim 1, wherein said- the one or more 
states are specified based on thresholds. 

3. (Original): The method recited in claim 1, wherein the notification is an event. 

4. (Currently Amended): The method recited in claim 1, wherein a state or state 
transition is a state or state transition of the particular component or interaction between the 
particular two or more components is a component, and wherein the step of generating the 
notification comprises generating the notification by the component. 
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(Currently Amended): The method recited in claim 1, wherein ii 

j -the particular component or interaction between the particular two or 
more components is an interaction between the particular two or more components, and 
wherein the notification is generated by at least one of the components involved in the 
interaction between the the particular two or more components . 

6. (Original): The method recited in claim 1, further comprising the step of: 
reporting the notification to a network management system. 

7. (Currently Amended): The method recited in claim 1, further comprising the step of: 
detecting whether a state or state transition has occurred that the particular component 

or interaction between the particular two or more components has entered the particular state 
or state transition ; and 

said notification is generated in response to said step of detecting. 

8. (Original): The method recited in claim 7, wherein, the step of detecting is performed 
by an agent. 

9. (Original): The method recited in claim 8, wherein the agent is a dedicated agent. 

10. (Currently Amended): The method recited in claim 1, further comprising the step of 



polling the said -particular component or the particular two or more components to determine 
whether a that the particular state or state transition has occurred. 

11. (Original): The method recited in claim 1, wherein the step of specifying one or more 
states and state transitions comprises specifying illegal states. 

12. (Original): The method recited in claim 1, wherein the step of specifying one or more 
states and state transitions comprises specifying undesired states. 

13. (Original): The method recited in claim 1, wherein the step of specifying one or more 
states and state transitions comprises specifying illegal states and undesired states. 

14. (Currently Amended): The method recited in claim 7[[6]], wherein detecting whether 
a state or state transition has occurred comprises determining whether a component or 
component interaction has entered the particular state or state transition is an illegal or 
undesired state. 

15. (Original): The method recited in claim 1 1 wherein an authorization violation and an 
authentication forgery are defined as illegal states. 

16. (Currently Amended): The method recited in claim 12, wherein a nongracefully 
sudden QoS degradation is defined as an undesired state. 
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17. (Currently Amended): The method recited in claim 1, further comprising the step of 
examining multiple notifications to deduce one or more trends regarding the network. 

18. (Currently Amended): The method recited in claim 17, wherein the step of examining 
multiple notifications comprises examining notifications for stable-behavior in a threshold 
value for a particular trend . 

19. (Currently Amended): The method recited in claim 17, wherein the step of examining 
multiple notifications comprises examining notifications for increases or decreases in a 
threshold value for a particular trend . 

20. (Currently Amended): A computer-based system for capturing illegal and undesired 
behavior for network components and for interactions between components, the system 
comprising: 

one or more network components , each network component configured to 
spontaneously generate notifications upon the occurrence of when specified states and state 
transitions occur involving the network component , wherein the specified state and state 
transitions include including one or more composite state transitions; and 

a network management system configured to receive said spontaneously generated 
notifications. 

21. (Original): The system of claim 20, further comprising: 
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an agent configured to detect the generation of notifications by the network 
components, and configured to report detected notifications to said network management 
system. 

22. (Currently Amended): The system of claim [[20]]2J_, further comprising: 

a state table configured to store said specified states and state transitions, including 
composite state transitions. 

23. (Currently Amended): The system of claim [[21]]22, wherein the state table is in a 
network management system. 

24. (Currently Amended): The system of claim [[21]]22, wherein the state table is in a 
network component. 

25. (Original): The system of claim 22, wherein the agent is further configured to 
examine one or more conditions of one or more network components and to query the state 
table to determine whether the one or more conditions represents an illegal or undesired state. 

26. (Original): The system of claim 22, wherein the agent is further configured to 
examine one or more transitions relating to one or more network components and to query 
the state table to determine whether the one or more transitions represents an illegal or 
undesired transition. 
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27. (Currently Amended): A computer-based system for capturing illegal and undesired 
behavior for network components and for interactions between components comprising: 

one or more network components; 

an agent configured to examine said network components to determine whether 
specified states or state transitions, including composite state transitions, have occurred, 
wherein the agent is configured to generate notifications upon a determination that a 
specified state or state transition has occurred, and wherein the agent is configured to report 
detected notifications to a_said-network management system; and 

s aid r fall network management system configured to receive reports of said generated 
notifications. 

28. (Original): The system of claim 27, further comprising: 

a state table configured to store said specified states and state transitions, including 
composite state transitions. 

29. (Currently Amended): A computer-readable storage medium carrying one or more 
sequences of instructions for capturing illegal and undesired behavior for network 
components and for interactions between components, which instructions, when executed by 
one or more processors, cause the one or more processors to carry out the steps of: 

specifying one or more states and state transitions for one or more components or 
interactions between two or more components, wherein specifying includes specifying at 
least one composite state transition; and 
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when a particular component or interaction between a particular two or more 
components enters a particular state or state transition if a said state or state transition occurs 
generating a notification corresponding to the particula r specified state or state transition^ 
wherein the particular state or state transition is one of the one or more states or state 
transitions . 

30. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein said- the one or more states are specified based on thresholds. 

3 1 . (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein said notifications are events. 

32. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein a state or state transition is a state or state transition of the particular 
component or interaction between the particular two or more components is a component, 
and wherein the step of generating the notification comprises generating the notification by 
the component. 

33. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein if the state or state transition relates to the particular component or 
interaction between the particular two or more components is an interaction between the 
particular two or more components, and wherein the notification is generated by at least one 
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of the components involved in the interaction between the the particular two or more 
components. 



34. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein the instructions for carrying out the step of creating and storing first 
information further comprise instructions for carrying out the step of: 
reporting the notification to a network management system. 



35. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein the instructions for carrying out the step of creating and storing first 
information further comprise instructions for carrying out the steps of: 

detecting whether a state or state transition has occurred that the particular component 
or interaction between the particular two or more components has entered the particular state 
or state transition ; and 

wherein i 

said notification is generated in response to said step of detecting. 



36. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 35, wherein the step of detecting is performed by an agent. 



37. (Currently Amended): IT AH The computer-readable storage medium as recited in 
Claim 36, wherein the agent is a dedicated agent. 
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38. (Currently Amended): [[A]] The computer-readable storage medium as recited in 
Claim 29, wherein the instructions for carrying out the step of creating and storing first 
information further comprise instructions for carrying out the step of: 

polling the said -particular component or the particular two or more components to 
determine whether a that the particular state or state transition has occurred. 

39. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein the step of specifying one or more states and state transitions comprises 
specifying illegal states. 

40. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein the step of specifying one or more states and state transitions comprises 
specifying undesired states. 

41. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein the step of specifying one or more states and state transitions comprises 
specifying illegal states and undesired states. 

42. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 35, wherein detecting whether a state or state transition has occurred comprises 
determining whether a component or component interaction has entered the particular state or 
state transition is an illegal or undesired state. 
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43. (Currently Amended): [[A]] The computer-readable storage medium as recited in 
Claim 39, wherein an authorization violation and an authentication forgery are defined as 
illegal states. 

44. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 40, wherein a non gracefully sudden QoS degradation is defined as an undesired state. 

45. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 29, wherein the instructions for carrying out the step of creating and storing first 
information further comprise instructions for carrying out the step of examining multiple 
notifications to deduce one or more trends regarding the network. 

46. (Currently Amended): IT All The computer-readable storage medium as recited in 
Claim 45, wherein the step of examining multiple notifications comprises examining 
notifications for stable-behavior in a threshold value for a particular trend . 

47. (Currently Amended): [[A]]The computer-readable storage medium as recited in 
Claim 45, wherein the step of examining multiple notifications comprises examining 
notifications for increases or decreases in a threshold value for a particular trend . 
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